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REMARKS 

Claims 1-5 and 7-36 are pending, with claims 1, 12, 17, 24 and 36 being independent. 
Claims 1, 12, 17-19, 24, and 36 have been amended. No new matter has been added. 
Reconsideration and allowance of the above-referenced application are respectfully requested. 

Specification - Objection to the Prior Amendment: 

The Office states that the prior amendment to the specification is considered new matter 
because it, "changes the definition of 'machine-readable medium' of originally filed disclosure" 
(see 12/1 8/2006 Office Action at page 7). It should be noted that those of ordinary skill in the art 
would have readily recognized from the Specification as filed that a "machine-readable medium " 
referring to a software product or computer program product would include such products 
embodied in a computer readable medium. Thus, the prior amendment to the Specification does 
not constitute new matter. Nonetheless, since the Office requires cancellation of the identified 
language, and in order to expedite prosecution, the new language has now been cancelled by this 
reply. 

Rejection Under 35 U.S.C. § 1 12: 

Claims 1 1-16, 21-23, 29-30 and 36 stand rejected under 35 U.S.C. § 1 12, first paragraph, 
as allegedly failing to comply with the enablement requirement. This contention is respectfully 
traversed. 

Claims 1 1 and 12 recite, "selecting the transport medium from a group including a 
peripheral device interface medium and a network communications medium", and claims 21, 29 
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and 36 recite similar features. The Specification describes that the selection of transport medium 
can be "based on current conditions" (see Specification at U [0034], page 9, lines 19-23). The 
Office Action states that, "it will be difficult for a person of ordinary skill in the art to ascertain 
the conditions based on which the selection of transport medium is done." (See 12/18/2006 
Office Action at page 8.) However, the Office Action then states that the Examiner was able to 
ascertain that these conditions can include whether or not the detection tool 540 is local. (See 
12/18/2006 Office Action at page 9.) This is correct, and makes clear that the enablement 
requirement has been satisfied. Other examples of the conditions include, which transport 
mediums are currently operational and any default communication settings a user has previously 
defined, as would be readily understood by those of ordinary skill in the art. Thus, all of claims 
11-16, 21-23, 29-30 and 36 are enabled by the Specification, and withdrawal of the rejection 
under 35 U.S. C. § 1 12 is respectfully requested. 

Rejection Under 35 U.S.C. § 101: 

Claim 1-16 and 18 stand rejected under 35 U.S.C. § 101 as allegedly being directed to 
non-statutory subject matter. Without conceding the propriety of this rejection, and in order to 
expedite prosecution, the claims have been amended to recite "machine-readable storage 
medium", as suggested by the Office. In view of this, withdrawal of the rejection under 35 
U.S.C. § 101 is respectfully requested. 
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Rejections Under 35 U.S.C. § 103: 

Claims 1-5, 8-15, 17-22, 24, 26-29 and 32-36 stand rejected under 35 U.S.C. § 103(a) as 
allegedly being unpatentable over Adelstein et al. (US 2004/0260733 Al) in view of Stevens 
(U.S. 2002/0133702 Al), with Assaf (US 6,728,830 Bl), Moore (US 2004/0003135 Al) and 
definition of Hardware Abstraction Layer (HAL) from http://en.wikipedia.org included as 
supporting documents. Claims 15, 23 and 30 stand rejected under 35 U.S.C. § 103(a) as 
allegedly being unpatentable over Adelstein et al. in view of Stevens and Assaf as applied to 
claims 1, 9-1 1 and 12, and further in view of William Stallings (Data & Computer 
Communications, sixth edition, published, 2000). Claim 7 stands rejected under 35 U.S.C. § 
103(a) as allegedly being unpatentable over Adelstein et al. in view of Stevens and Assaf as 
applied to claims 1-5, and further in view of Rothman et al. (US 2004/0158698 Al). Claims 16 
and 30 stand rejected under 35 U.S.C. § 103(a) as allegedly being unpatentable over Adelstein et 
al. in view of Stevens and Assaf as applied to claims 1,9-14 and 24-29, and further in view of 
Joy et al. (US 2002/0093982 Al). Claims 25 and 31 stand rejected under 35 U.S.C. § 103(a) as 
allegedly being unpatentable over Adelstein et al. in view of Stevens and Assaf, and further in 
view of NIST (National Institute of Standards and Technology) Hard Disk Write Block Tool 
Specification. These contentions are respectfully traversed. 

Independent claims 1, 12, 17, 24 and 36 have been amended to more clearly emphasize 
their patentable distinctions. Each of claims 1, 12, 17, 24 and 36 now recite, "bypassing any 
storage area protection interface capabilities included in a Basic Input Output System (BIOS) of 
the data processing system". As described in the Specification: 
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The protected area 212 of the storage device 210 effectively offers malicious 
users a place to store contraband or malware. Since the protected area 212 is not 
normally seen by the system BIOS or operating system, many computer forensics 
tools do not detect, analyze or image this area, or at least cannot do so easily. To 
assist law enforcement and information security personnel in determining if a user 
has utilized the protected area 212 to hide contraband or malware, a kernel-mode 
software module 230 can be used to provide access to the protected area 212 and 
enable live imaging and analysis of the protected area 212 from within the 
running operating system 220 and without rebooting the data processing system 



Thus, the software module 230 and the detection application 240 can provide 
direct and live access to the protected storage area 212 in order to image or 
analyze the protected storage area 212 in support of some detection function. The 
software module 230 and the detection application 240 enable direct access to the 
protected storage area live from the high level operating system without the need 
to reboot. 

(See Specification at 21 and 23; and Fig. 2; emphasis added.) 

Stevens describes methods for granting access to a protected area, such as a hard disk 
drive of a computer, after the computer has been booted, by introducing BIOS (Basic 
Input/Output System) modules that may be accessed after the computer is in normal operation. 
(See e.g., Stevens at |s 8-9, 19, 45-46, 48-49, and 53.) Furthermore, Stevens teaches that a 
calling process can access the protected area 27 by locating and using an interface of the system 
firmware . (See e.g., Stevens at H 64; emphasis added.) The focus of Stevens is to add storage 



200. 



[...] 
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area protection interface capabilities to system firmware (i.e., the BIOS) in order to facilitate 
storage of data. 

In contrast, the presently claimed subject matter involves bypassing any storage area 
protection interface capabilities included in BIOS, as described in Stevens, when removing 
storage area protection, in order to analyze the protected area to assist law enforcement and 
information security personnel in determining if a user has utilized the protected area to hide 
contraband or malware. Because of this purpose, it is important that the claimed subject matter 
not rely on particular storage area protection interface capabilities of system firmware, as 
descried in Stevens, which may be not be present on target computing systems. Since a specific 
type of BIOS is not required by the claimed subject matter, many more computing systems can 
be analyzed. 

Thus, independent claims 1, 12, 17, 24 and 36 are each clearly distinguished from the 
proposed combinations of references and should be in condition for allowance. Dependent 
claims 2-5, 7-11, 13-16, 18-23 and 25-35 should be patentable based on the above arguments and 
the additional recitations they contain. 

Conclusion 

It is believed that all of the pending claims have been addressed. However, the absence 
of a reply to a specific issue or comment does not signify agreement with or concession of that 
issue or comment. Because the arguments made above may not be exhaustive, there may be 
reasons for patentability of any or all pending claims (or other claims) that have not been 
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expressed. Finally, nothing in this paper should be construed as an intent to concede any issue 
with regard to any claim, except as specifically stated in this paper, and the amendment of any 
claim does not necessarily signify concession of unpatentability of the claim prior to its 
amendment. 

It is respectfully suggested for all of these reasons, that the current rejections are 
overcome, that none of the cited art teaches or suggests the features which are claimed, and 
therefore that all of these claims should be in condition for allowance. A formal notice of 
allowance is thus respectfully requested. 

Please apply the one month extension of time fee, and any other necessary charges or 
credits to deposit account 06-1050. 
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